Apple unveils 'Passwords' manager app at WWDC 2024
zdnet.com
zdnet.com
Years ago I bought 1Password via a one off payment and set it up to sync via my iCloud Drive. It all worked great. Then they took VC investment and quickly every new feature was locked behind a subscription gate. I switched to Bitwarden. Then they took VC investment and I’m sure will end up down the same path (and you could never use a third party storage service with BW AFAIK). A password manager’s remote storage doesn’t need to be anything other than a safely encrypted SQLite file, you ought to be able to save it anywhere.
I think everyone should have a good password manager in 2024 and non tech inclined folks shouldn’t have to battle with upsells and spammy notifications as a price for being secure. If that means they’re using Apple’s offering, so be it.
Btw, is keepassxc on Android now or are you referring to one of the many Android keepass apps? I use keepassium on iOS.
I pay for protonmail and also store a copy in protonpass. Proton pass has a nice web interface and doesn’t require me to copy a keepass file or logon to iCloud on my work computer so I use that sometimes too.
KeepassXC does have collaborative features and online sync if you just drop the Keepass file in a shared cloud - I use it this way and it's easy to set up. Also, more importantly, the password database is not stored in some server God knows where.
Well..
This is why we use it! Also, it's free. Paying subs for software feels dirty.
I’ve payed for 1Password for 4 years and am a happy customer. But I would also be willing to try KeepassXC if it really offers feature parity.
These are some features important to me, are they supported by KeePassXC?
- Easy password sharing with my wife. We have separate private vaults and a shared vault, and moving a passwords between these vaults is seamless.
- Sync has been seamless for years. I don’t have to worry about e.g. iCloud corrupting my password database and having to restore from off-site backups.
- Integration with many platforms. Currently, that means autofilling/autosaving/generating passwords in common browsers, on MacOS, and on iOS.
- Generating and filling TOTP tokens (no need for Google Authenticator or similar apps).
- Storing and syncing SSH certificates, including acting as an SSH agent (so I have to scan my fingerprint to allow a new SSH authentication).
- Storing non-password items in the encrypted store, e.g. pictures of passports.
- TouchID or FaceID for quick unlocking with everyday use.
Not sure about this one. I don't even collaborate passwords in Apple keychain with my own family.
> - Sync has been seamless for years. I don’t have to worry about e.g. iCloud corrupting my password database and having to restore from off-site backups.
Sync with iCloud Drive, Dropbox, Google Drive have been fine for a long time. Plus theres also the option to just keep a password database copy handy.
> - Integration with many platforms. Currently, that means autofilling/autosaving/generating passwords in common browsers, on MacOS, and on iOS.
KeePass is usable on more platforms than 1Password sorry. You could probably get one keepass app or another running on some ancient power PC box running netbsd..
> - Generating and filling TOTP tokens (no need for Google Authenticator or similar apps).
KeePassXC does this
> - Storing and syncing SSH certificates, including acting as an SSH agent (so I have to scan my fingerprint to allow a new SSH authentication).
I have not tried this one, but would be surprised if KeePassXC doesn't do this as well
> - Storing non-password items in the encrypted store, e.g. pictures of passports.
KeePassXC definitely does notes, not sure about photos etc. This is definitely the realm of an encrypted Apple Note for me though.
> - TouchID or FaceID for quick unlocking with everyday use.
KeePassXC has this on Mac, KeePassium does it on iOS really well...
On the desktop there is even a CLI app for interacting with the database, though I also use KeepassXC.
There is a little bit of subtlety to this https://www.cs.ox.ac.uk/files/6487/pwvault.pdf
I’m a tech person and even I don’t want to be responsible for running a Vaultwarden server, the average user definitely doesn’t want to.
KeePass was a great bit of software but managing the vault syncing myself and having to wait for (and trust) the third-party Firefox extension to update was tiresome. For about a buck a month, LP was a pretty good deal and handled all of that overhead for me.
I eventually moved to 1Password and it's still what I recommend to most people. $45CAD a year is a pittance for how often I use it. The app and extensions are always up to date, they "just work" even for my 70 year old father. At $12CAD a year, Bitwarden is pretty damn reasonable too.
I don't get the hand-wringing when it comes to reasonably priced services. Development and infrastructure costs money. Yes, a power user can manage everything entirely with free software and a portable sqlite db but that isn't sensible approach for the vast majority of people.
I've been a 1password customer for as long as I can recall, and it feels weird dumping my subscription to save a few bucks when it's been such a great service at a fair price the whole time. Why I'd keep it around if the OS solves the same problems, I don't know … just saying it feels weird.
In particular, the reason it's annoying to sync keepass is because of how the program is designed. There are other managers in that ecosystem that let you log in to google/microsoft/dropbox/anything and then you're done. It all syncs perfectly from then on. It's a development problem, not a need for a dedicated service tied to a specific password manager.
And when I'm considering development cost I'm going to look at things on a 5 or 10 year timeline. I think that's a reasonable length to expect a software purchase to last. On that timescale, Bitwarden is okay but 1Password is not at all a good price.
(Also I didn't mean thousands of free services, I meant that each one will give you thousands of megabytes for free. Honestly just google and microsoft accounts, and icloud with a device, cover just about everyone. But there are a lot of free storage services if you want them.)
The program itself might not get information efficiently to do conflict resolution (or not at all): for example, you edit a file offline and sync, Dropbox and friends wouldn't be smart enough to just append both of a few bytes worth of data that a password-manager controlled service could since it would be aware of the data structure but would just dump both files, and then both on another conflict etc
So I guess it's just not the same type of sync service that you get for free in those many services
(also I think it's more than a sub-Mb, you have icons there, but also images of docs and what not)
Though maybe this is not an issue as you mention some of the keepass-based apps that go the "app-sync" route instead of manually placed file?
Right, my main concern here is programs that talk directly to the service's API, because that's the easiest to implement in a correct way. Dumb file storage, but without the worry of stale versions appearing.
Though most people don't need their vault to be robust against simultaneous offline edits from multiple devices.
> (also I think it's more than a sub-Mb, you have icons there, but also images of docs and what not)
I have usernames/urls/passwords, some notes, some icons, and some ssh and bitlocker key files. In total it's 159KB, including a bunch of version history and the recycle bin.
What kind of documents would I put in a password file?
Though some extra megabytes don't really affect my argument much.
This is one of those very rare cases with potentially huge negative effect to make it into a mandatory feature.
> Dumb file storage
Which still suffers from inefficient incremental updates. Curious whether those other managers deal with that (do they split your vault into parts)?
> What kind of documents would I put in a password file?
Whatever documents you want to securely share with others, various scanned docs, so it's not just a few megs, (e.g., Bitwarden offers up to 1G encrypted file attachments) (though don't use this either, mine is just a few megs)
The only thing you would need to make mandatory is a direct login to any storage service.
> Which still suffers from inefficient incremental updates. Curious whether those other managers deal with that (do they split your vault into parts)?
If it's a megabyte, who cares? You could have a way to split things or upload an update log, but it's not worth it.
If you need big attachments, then keep them outside the core vault file.
> Whatever documents you want to securely share with others
Sharing is where a dedicated service is useful.
But if a feature like that needs a paid service, it should be an optional upgrade.
I have no problem paying for software. But in this case I’d far prefer a one-off purchase. The only reason there are ongoing infrastructure costs are because I’m being forced into using the company’s cloud service. I already pay for infrastructure in the form of my own cloud storage. I want to pay, once, for software that will use that infrastructure.
More generally, while I might see the value in paying $45 a year for a password service a lot of non-tech folks don’t. They’re happy using the same password everywhere they go (until they aren’t, of course), making them pay a few months-worth of Netflix to use software they’re already not inclined to use means they just won’t do it.
For me, it has nothing to do with the price and everything to do with the fact that I don't want a service dependency for my most critical passwords. I want them to be available no matter what. The product should be standalone. And this isn't a hypothetical concern, either: my employer is contractually mandated to disallow cloud-based password managers, so I must use standalone ones (yes, this is a stupid policy, but one that I'm bound by).
And on top of that, 1Password 5 was an excellent product and it is just steadily getting worse, in my opinion.
I don't know if Apple Passwords will be a perfect fit for me, I'm hoping someone shares a deep dive on the product soon because I'm not in a position to use the beta, but I'm happy to see some more competition in the space.
I have the app open in front of me but haven’t used it much. It’s basically the Passwords pane from System Settings ripped out and with some new fixed smart categories. If that’s enough for you, so will the app be. If not, not.
I’m using it on iPad, macOS, iOS and windows 10 and 11. Seems per much the same as it’s always been.
I’ve got the family using it too.
Just curious what issues other people are experiencing.
It seems their focus is to drive this into the browser extension but that doesn't cover all of my use cases - I very often need to generate a login password _outside_ the context of a browser and doing so now requires me to open the application and create a new password and save that record while before it was one click away in the menubar.
I'm also annoyed that we're no longer able to define which vaults are included in "all vaults" and the inability to simultaneously disable the browser extension from injecting their UI into websites (the login icons, blue input fields, etc) while keeping the prompt to save a login when a new one is detected.
They've constantly been downgrading the quality and the polish of the macOS app, just for "cross-platform" feature parity- leading to a subpar experience everywhere (Windows is a whole another can of worms).
Don't get me wrong, I'm not a fan of Electron, and I'd prefer it have remained a native app, but that alone wouldn't be enough for me to jump ship. And I'm not even claiming alternatives are better than v8; it's simply that v7 was much better, and I'm actively looking for alternatives.
You can run your own BW server, or at least you could as of a few years ago. It's not well documented, but it was doable. The only reason I don't use BW is because the iOS app doesn't locally cache passwords, and I didn't want to open up my home network or set up a VPN just for a bitwarden server.
And it's not that big a deal to occasionally copy a password onto a Linux or Windows device, or better yet, use the iPhone to authenticate for it.
Besides just working as expected, it importantly supports self-hosting. I don't currently make use of that, but have given it a try and it's great as well.
Having alternatives to the SaaS (currently very reasonably priced) is invaluable.
https://bitwarden.com/pricing/#:~:text=for%20Organizational%...
I've been using it for nearly 20 years and it's been going down hill fast for the last 5, but 1Password 8 is an absolute clown car. It hijacks your passkey logins meaning that authenticating with Tailscale for me has gone from a single touch of the TouchID button on my Mac, to 1) click button that says "Unlock 1Password", 2) Click it again because it did fuck all the first time, 3) hit the global hotkey for 1Password, 4) open 1Password via Alfred because the hotkey has decided to stop working again, 5) touch the TouchID button to unlock 1Password, 6) switch back to the browser to find that my Tailscale auth has timed out, 7) back to iTerm to initiate the auth again, 8) if I'm lucky, I can now touch the TouchID button to use my Apple passkey, if I'm not, it's back to step 1.
I'd challenge anyone to name an app that has been ruined more by VC money than 1Password.
https://support.apple.com/guide/iphone/share-passwords-iphe6...
I’m with you on 1P. I bought every version starting in 2009, until the constant push to subscribe made me stop. The part their VCs should be afraid of is that switching took about 5 minutes (export + import) and the only change I noticed is that everything is faster. That moat is a trickle of water (I hope it’s water) and they’ve annoyed a lot of the people who used to be telling their friends and family to buy it.
I'm sure 1Password doesn't care one iota about loosing individual users with attitudes like this. Until the forced to a monthly rent seeking hand in my pocket policy was deployed, I had been a vocal advocate for 1Pass. Now, they're about to loose me altogether
It would be. Fortunately, 1Password doesn’t do that [1].
You’re paying for an important piece of software to be maintained.
> I'm sure 1Password doesn't care one iota about loosing individual users with attitudes like this
Probably not. Emphasis on attitude.
We can have upgrades and working software that gets updates without monthly fees to do it. I also do not need their cloud and only features. They intentionally removed the local vaults specifically to force you to use their cloud. That was the last straw for me.
Where did I or OP say this?
> can have upgrades and working software that gets updates without monthly fees to do it
It’s a bad financial model.
> intentionally removed the local vaults
This is a valid disagreement.
If I am required to pay you monthly for a product there becomes less and less reason for the owner of said product to improve the product. With the hassle that comes with switching password managers (even for myself, I provide three families with this product (my parents, my sisters family)) there is a lot of friction involved with leaving a product that is stagnant that I am paying monthly for.
I was much happier with 1password when i was able to evaluate their new major version, see if any features of it were compelling to me and my extended family and make a decision wether or not it was worth the asking price. Generally speaking a major version wouldn't get huge changes over it's lifetime, maybe some bugfixes, maybe some ui improvements around it's new features (could also be considered bugfixes), any security issues that cropped up. At that point their development staff was more focused on brand new features for the next major version.
I think what we ran into, partially, with 1password is them running out of ideas for their next major version. A password manager, to a consumer, is not a super complicated product that requires a bunch features, a lot of the work is in the encryption and security which isn't really consumer facing.
No, the last twenty years has show us that we can't.
If you want developers to perform ongoing work on their products, you need to accept a model where there's ongoing pay for that work.
Before they switched to subscriptions, it still worked like that: 1Password 4, 1Password 5, 1Password 6 - I paid money each time a new version came out. Sometimes I paid the same day of the release and upgraded immediately. Other times, I may have waited a little bit longer and continued with the version that I had.
Nobody's asking for a free lunch.
Strongly disagree that they're part of the group of SaaS companies trying to price gouge their users.
Dislike of SaaS isn't limited to monthly fees, but the lack of features they removed to encourage SaaS adoption
I'm on your side in all the comments I've read so far (especially the "freeloader" one), but this one is a clear "assume the worst" which isn't fair to GP. Their comment could very well have been a legitimate and innocent question. Of course it could have been a majorly failed attempt at a troll (since the question has great answers) but assuming the worst just drags everything down. IMHO better to give benefit of the doubt, even if only for the other people reading it later.
I felt that way on principle for a long time, but honestly, on reflection, 1P is probably subscription that is most justifiable. I want to outsource online security to people that know what they are doing. I want that to be a viable business for a long time into the future. And I want their funding model to be such that their interests are aligned with those of their paying users (me).
People can get so irrational when it comes to the cost of software. The same person who'd pay hundreds of dollars for a cleaner, or a gym membership, will swear up and down that 70 bucks a year for an online bodyguard is highway robbery.
Often while refusing to work for less than six figures as a SWE, hating on companies for seeking VC funding, dismissing non open-source approaches, and then complaining why there aren't more alternatives :)
I think this new interface to the password feature in macos will probably put even more of a dent into 1password/bitwarden/etc's consumer business driving them even further into catering to enterprise, it's a pitty, but 'this isn't a product, this a feature'.
The current version of 1Password is pretty much seamless for me across Linux, Mac, and iPhone. It's more seamless than it ever was before, honestly. It works for my technical needs and my parents' non-technical needs alike, and greatly simplifies tech support for the latter. I would sincerely recommend giving it a shot if you haven't already.
> I'm not sure a password database is a 'online bodyguard'.
If that's all 1P is, why not just spin up an SQL db yourself? Because, of course, that's not all 1P is. It's a database, a GUI (for five OSes on two architectures, plus web), extensions to auto-fill (and recognise new passwords, or changed passwords) on a range of ever-changing browsers / websites, a great deal of security hardening for their software and servers, an office full of people that evaluate and consider how to combat emerging threat models, etc. None of this is technically impossible to handle yourself, but that's an extremely inefficient allocation of most people's time.
What initially attracted me to 1password was certainly it's browser integration features but after switching to keychain I find the 1password save login/autofill interfaces to be clunky and jarring... and the input/search interface. Those features would be hard for me to write myself, however given that 1password when they killed local vaults also switched to a resource hogging cross platform framework (electron) for it's 'native apps' at the same time.. well two straws that broke my back in that case.
My current 1password vault probably has a dozen entries, I've considered moving them to just an encrypted (doubly encrypted I guess) note inside keychain for break glass emergencies.
While 1Password probably wouldn't have gotten as popular as it is, if they started as a SaaS, instead of letting everyone think they could just buy it one time and be done, I doubt anyone would be angry about it.
I agree regarding 1pass, but at least it's still firmly trying to solve the password management problem. Apple is trying to solve the vendor lock-in problem (i.e. how can they lock more users in to their platform).
Every other password manager I have tried has had continuous churn, nothing consistent after a couple years.
I have passwords for accounts in my Apple keychain that have survived more than decade and about half a dozen different devices, to internal servers that have been dead for a decade.
The only new thing here is opening it up to more platforms.
I’m finding most of the friction with 1Password I run into is actually Apple competing for autofill in Safari creating two completely different UIs above every form element.
The other issue I have is Safari Home apps not supporting extensions so you can only use Safari’s built in manager. I think that’s fixed in Sequoia.
Passwords.app will be used by folks who can’t be bothered to pay for a password manager, which won’t do much to 1Password’s bottom line.
There’s a lot of prior art like Apple uses Cisco WebEx instead of FaceTime for video collaboration. The products Apple produces are just very different than their enterprise counterparts.
I'm actually of the same opinion as the GP comment, modulo that I'm not ever going to jump ship to an Apple password manager, but I'll point out that 1Password will most certainly not get Sherlocked since they are not Apple-centric and thus Apple would have to (gasp) release a Passwords.app client for Windows and Linux plus a cli and kubernetes operator in order to hold a candle to the reach that 1P has
You know that you can disable Safari's autofill, right? I recommend it if you're using another password manager.
I don't remember seeing those for Apple. Are there examples of anyone failing to get meaningful help from official support but were able to find a successful resolution through HN ?
Apple has devs. Maybe some teams are short-staffed, but they fix things.
What Apple doesn't seem to have is a functional bugfix priority loop that includes customer input and provides feedback.
* It's incompatible with some apps, e.g. Roblox, that are full-screened, and you end up in an annoying loop between the Roblox screen and the request more time screen fighting with each other, with no ability to click anything. My kid has learned how to hit the Option-Command-Escape shortcut to force-kill Roblox using just the keyboard and restart.
* Sometimes Screen Time requests come via Notifications (yay), and sometimes they come via Messages (boo). There doesn't appear to be any logic behind which.
* When they come in via Messages, and I leave Messages.app running for too long, it ends up eating all of the memory on my 32GB M1 Max and forcing me to restart the system.
* Sometimes requests do not come through at all.
* Sometimes the user cannot request more time. Clicking the button does nothing.
* Sometimes multiple requests come through for the same app. Approving one of the requests does not satisfy all of them, you have to approve all of them.
* Requests for websites do not work. Every so often Roblox breaks and results in having to re-download the .dmg. You end up in a loop between approving the request for more time and the website saying the user needs to request more time. I ended up writing a shell script to curl it instead (which requires munging User-Agent because the Roblox download page does not have a direct link to the dmg).
It's clear there are no Apple employees who actually use Screen Time to manage kids time. I can only assume they just let their kids have unlimited access, because trying to actually use Screen Time is absolutely infuriating, and only gets worse over time (e.g. the Notifications vs Messages thing is a recent regression).
It's also worth pointing out that I have absolutely zero issues with Android Family Link. It all Just Works for similar purposes.
Oh this is a good one I forgot. If my kid is playing Roblox and runs out of time, it goes into that screen loop and is impossible to resolve without at least killing Roblox, and sometimes rebooting the silly machine. That's pretty frustrating for the kid for sure, I ended up just whitelisting Roblox so it never happened.
1. It randomly adds in limits for my kids I didn't even put there. I put in an X hour limit, it puts in an Y hour limit, usually duplicated three or four times. Most commonly for the 'All apps' category. I delete those, a few weeks later they start reappearing. Kid complains, I delete them again, rinse & repeat.
2. Somewhat regularly it loses connection to the kids' ipads and doesn't update the settings I change. Usually it'll eventually connect, but it can take a while.
3. Some devices it just refuses to see. iMac? Sure. MacBook Air? Crickets. Why? Who knows. Everything is running the latest software, both computers have the iCloud account authenticated. Sometimes it decides my son has no devices at all. I don't really bother looking at reports any more.
4. Sometimes I get screen time requests (install a new app, ask for more time, buy something, etc), and sometimes ... nothin. I can watch my kid put the request in, I never get it. Sometimes it's flawless.
5. The requests come in via iMessage now, and this tends to be okay on the phone, but it is very destructive on the MacOS Messages app. The requests almost never completely load, for whatever reason, and just spin. I think only once I saw the requests show up on the MacOS Messages app correctly. Eventually the requests conversation gets too many of them spinning, and they drag down Messages until it beach balls. If I'm lucky, I see that one coming as it gets slower and delete the conversation before it gets far enough to hang.
There are probably some things I'm forgetting. It is the buggiest bit of software from Apple that I've ever used. The only other app that routinely annoys me is Music, because it periodically (every day or so) seems to lose authorization or something, and just refuses to play music. But doesn't say why, doesn't reauthorize or ask to reauthorize, just doesn't play anything. I restart the app and it works for another day. That bug has been around for several years now, on multiple computers.
I'm not really a fan of 1Password overall though. The product is still fine but has gotten gradually worse over the years and their corporate posture does not inspire any confidence. Consumer apps that focus on Enterprise and are only interested in SaaS revenue almost always follow the same path of endlessly degrading the user experience once they reach a certain point. I haven't seen anything that makes me think they will be an exception, but I give them credit for actually having a real support channel, at least as of a few years ago.
https://1password.community/discussion/128524/add-options-to...
Seriously, this is the kind of thing that an intern could knock out in a week. I don’t understand why it hasn’t been addressed.
> The Passwords app is free to download, available across iOS 18, iPadOS 18, and MacOS 15, and will also work with the Vision Pro and Windows computers, says Apple.
Probably so, but there is one demographic well represented here that does this routinely: Developers. Macs are the default and often mandatory computers issued to developers at tech companies (I strongly disagree with this approach and think employees should get the platform they are most comfortable on, but Macs only is the current state of things in most places).
So many use Macs because of work, but have Android phones due to reasons I won't articulate here, mostly due to time but also with the audience on this article I expect it would melt down into an argument about which flavor of ice cream is better (metaphorically, not literally). Suffice it to say, Android users would agree with the reasons, Apple users will say you shouldn't be doing those things anyway, and we'll have to agree to disagree.
Anecdotally, it's also my subtle impression that iPhone users are more inclined to update frequently regardless of how much longevity they could get out of it. I just buy my phone and keep it operational for as long as possible, only buying another if my current one is physically inoperable, and I feel like I'd get to that point more quickly with an iPhone, since parts are more expensive and not as readily available.
I suppose that Apple really considers the iPhone to be the center of its customer's lives, with a Mac or Windows computer... rather than my view, of my computer being the center and my phone tertiary.
You actually care about your computer, and if software isn't available for your OS then you're unlikely to ever switch OS to use it.
But you could be persuaded to move to iPhone, and maybe if enough new Apple services (which aren't available on Android) tempt your wife then she might make her next phone an iPhone, too?
Apple cares more about persuading people to switch from Android to iPhone than about Windows to Mac. But I also suspect there are many more Windows+iPhone people than Mac+Android.
The other major password managers are on Linux, and Apple will need to support Linux for this new offering to be interesting to me.
Of the major tech companies, Apple probably has the worst track record of not playing nice with other platforms, walled gardens and all. Passwords are needed on all platforms. Apple would be the last company I would trust to ensure that I would be able to access my passwords anywhere I may need them.
The desktop and tablet version will be released this year though.
I still really hate the iOS-restyled system prefs. Tiny unresizable text, a long vertical scroll. I can’t find a damn thing in it and just use the search bar every time and feel faintly annoyed about it.
But my biggest one is wanting to store secure files. Think copies of a drivers license, signed documents or various certs and keys. That's not being covered here either for me sadly. It's not a super common situation for me so I can probably find an alternative app for that purpose.
Edit: Also for notes, I'd just password protect something in the Notes app. But that's just me.
I frankly just have photos of DL and insurance cards in my photos with tags to make finding them easy. Although note with the text searchable images that’s largely not even needed.
I don’t get what the security concern in. My photo reel is way more secure than my actual wallet.
Hopefully Adobe won’t decide to start shitting a bunch of authorization credentials into private Notes the way they took over the Private Notes section of Keychain.
I have a soft spot in my heart for `pass` (http://www.passwordstore.org/), but it's a pain to access it from my phone.
I use BW for all my personal stuff because my wife and I use it.
If your phone is android, I'd recommend https://passwordstore.app/ plus syncthing :-)
Glad they're splitting it out of System Settings into a dedicated app.
I've also started migrating family members to it. It'll be way easier for the less technical people since it's already tightly integrated in the devices and OS they use everyday.
However it asks once, across all Terminal programs, for the entire lifetime. So if you’ve ever used “find ~/Documents -…”, then Maven can access it too.
My opinion about this is that we’ll progressively go towards a Dockerization of the builds, which is the only one that gives developers confidence about the sandboxing.
It should be required by SOC2/PII certifications, though. As in, I already think I’ve seen an insurance ask something like “Are accounting documents present on a machine where compilation is executed” or maybe it was “Is it possible to install new programs on machines where sensitive documents are managed?”
The autocomplete attribute supports nearly everything you can imagine. Check this for a full list[2].
[1] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/In...
[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
I will NEVER understand this one. Do they want me to pick a shitty password? I'm not gong to type a string of of 20 mixed-case and special characters into a private text box on my phone. It always takes 3 or 4 tries to even get it right.
This user-hostile UX decision is simply unjustifiable. It's baffling how this even gets past code review.
It's fantastic, and for some reason I trust OS/browser developers to do this more safely than a company focused on password management that has to figure out OS APIs, write browser extensions, or rely on a clipboard that has nearly unbounded read access.
At least on iOS, this works for any password manager.
Android's autofill framework is open to everyone to use, and every third-party password manager has a Chrome plugin. I use Bitwarden with exactly this experience, but across Firefox and Chrome and Android.
and where do you store your passwords for apps?
I use KeePassXC to store passwords for apps.
So you have two password managers one for Firefox and the other for apps. What happens if you have an app login that is also a web site? Two entries of the same thing?
There's not much else to add: it just worked. I wish all "lock in" were that open.
[1] https://gist.github.com/jftuga/0265e5403d56373662b9513d8816e...
Keepass is the closest I've ever felt to just having a wallet for my passwords. It should be ratified as a standard, so we can make Google and Apple provide "Export to Keepass" buttons in their apps.
Check Passlane here (I’m the author of it): https://github.com/anssip/passlane
Would it make sense to use this for storing keys used other shell scripts?
Does it support hardware keys?
If my script could retrieve a password from my KeePass DB if it's unlocked, or ask me to unlock it, that would be cool.
But i would like to hear more details of the corruption if parent is willing to share. This is pretty much my worst nightmare scenario.
https://x.com/blader/status/1800263787746066646
"apple sherlocked 1Password today, so i'd like to remind you that your Apple ID is only as secure as your carrier.
if you have 2FA on and get SIM swapped, attackers can lock you out of it PERMANENTLY.
last month it happened to me. make sure it doesn't happen to you: "
Getting locked out of all my passwords would be pretty disastrous. Did Apple announce a change to the account lockout procedure as well?
I constantly have issues with it not engaging on a form where I have to manually switch to 1pw, though it has gotten a bit better over the years.
I hate to see a company/product get sherlocked but I don't feel like password security was something we should need to have a subscription for.
Whenever I do a password change, I have to do it on my phone, so that the new one will be stored. But that is fine with me. I’m happy to do that in exchange for being freed from “password managers”.
Really no big difference, you’re still technically using a password manager.
Also you can access those passwords on Mac as well, it’s in settings just as you would find it in your phone. No need to copy from your phone and paste it, Mac can autofill. It can also autofill on other browsers through the dedicated right click menu, but it’s a bit more clunky than on Safari.
Fun fact, those same passwords can be accessed on windows now, install iCloud for windows and enable passwords. It uses a dedicated app on Windows.
I also enable keychain sync on my Mac so I can create passwords there too.
Right now for instance I have a Personal profile, and a few work specific ones around admin, development, and my day-to-day work to split things off easily. I have 1Password unlocked in one profile and it works in that, but if I switch to any other profile it needs to be unlocked, then it tells me it needs to reload the extension. Reloading it doesn't do anything but break it again. I have to fully quit Safari then it works again for some unknown amount of time then falls apart completely soon after (probably laptop sleep or something like that).
Just a shitshow all around from 1Password anymore. How the mighty have fallen due to profits and investors.
My current workaround is to use Orion as my browser. Its profiles are clunkier than safari and don't exist on iOS (but I don't care about that)
Each profile produces a separate Orion.app so you end up with multiple Orion's in your dock - Safari is still the same top level app.
Extensions - in Orion each app is totally separate, in Safari there is one list of extensions and you choose which ones you want in your profile, of course the Safari extensions are clunkier than Orion which is what this thread is about, 1password not working,
It also feels like Safari takes less memory using this approach but I have not measured this.
Bookmarks differ - Orion's are totally separate, Safari's are all one tree and each profile takes a different root in the tree for the Bookmarks Bar so it is easier to move Bookmarks between profiles in Safari. And favourites are the same in all Safari profiles whilst Orion are separate, I prefer Safari here but I can see some justification for Orion's total separation.
Just retried Safari - and discovered it is more difficult to switch profiles than I remebered. The list of profiles are at the bottom of the Window menu which is harder to get to than Orion being an icon or on the tool bar - Safari for iOS is better here as it puts the profile on the toolbar (presumably as there is no menu and only one window) I just rediscovered the quick way for safari - choose the window from the dock icon.
Orions sidebar is better as it removes the tabs from the top and also indents tabs that you open from the parent tab. However the sidebar is not up to the standard of Firefox's Tree Style Tab adding.
Something I’d really like: let my iPhone act as a Bluetooth (obviously encryption will be necessary!) or USB keyboard, and have it hold my passwords/type them. That way I could keep my passwords all in one place, and manage them locally. Currently I use keepass when not on iOS, which is fine, but I don’t really want to have to expose my whole passwords file to a Windows machine, since they are traditionally infested with malware (and apparently MS is flirting with including their own first party malware).
I investigated the bluetooth encryption and it didn't really seem up to the task. You could create a dongle that lived on wifi though that would do the same.
https://www.google.com/search?q=password+manager+with+usb+ke...
https://github.com/tejado/Authorizer
https://hackaday.com/2020/02/08/usb-password-keeper-runs-on-...
https://www.amazon.com/OnlyKey-Stealth-Black-Case-Communicat...
A dedicated device would be nice and, actually, keeping your passwords on something that never even has to touch the internet would be ideal. But my phone already has a nice big touchscreen to make it easier to pick a password. Reusing an old device could work but that’s limited.
the really secure way I was thinking is a small touch device that could be small enough to slide into your wallet or even as a device that would live in a phone case exposed on the back of your phone. then there would be a small yubi key like dongle that you'd plug in to whatever your target device is and it would communicate over wifi. that would be like the ultra paranoid version. then you could have the iphone/android app that communicates with the dongle, the one that uses BT encryption, the one that uses a USB cable from the phone to emulate a keyboard.. options are endless.
there's some features you could have like computer vision to recognize the login prompt. it's easy to get into an imaginative loop with the ideas.
I tried out passwords, and combined with Safari, it's an absolute godsend compared to 1Password. That does mean that I switched from Brave to Safari, and thus have YouTube ads, and so I'm now paying for YouTube haha
This isn't my experience since the recent update that shows up a mini-login panel when trying to sign in. The old experience that opened the desktop app first was fairly slow.
I'm leaving that platform. They've taken shittification to new heights.
I don’t want to switch from 1pass if I can’t set 2 or 3 separate webdomains for an account as I find this to be the most annoying feature of apple passwords, when a website has a separate register page from it’s login pages. In 1pass you can just delete the subdomain and add domains. Apple doesn’t allow you to edit at all :(
Whereas with 1Password I use a separate app to CREATE a new Login file for an app/website/anything. I can save that file with as much or a little information filled out as desired. Can create arbitrary info files for Passports, library membership cards, etc. I know the information for each is forever stored exactly as I created it, always syncing, never overwritten when I type in a different password and accidentally hit "save" in a webform.
I hope the new Apple Passwords app is more like the later; if so I would switch.
My main reason not to use it is because I guess not going to work as well with firefox desktop?
If it were just me, I'd be tempted to just switch everything over. My wife is smart, and technically competent, but isn't interested in switching to new things until the pain points are too much. If I want to move to a new app or a new service, it can't be on a whim of mine, and it can't just be because I want to see what the new features are like.
I have been working on solving password management as a local-first, cross-platform, open-source application[1]. It's a bit rough around the edges still (no browser extension yet!) but is worth trying as an alternative. Any feedback would be much appreciated!
The app is designed for zero vendor lock-in (after all this is our most sensitive data) and a self-hosted server is part of the design. We aim to make money offering a cloud platform for syncing and social recovery (digital inheritance) and eventually would like to also function as a Dropbox/Keybase alternative.
We will be releasing the open-source SDK[2] soon.
All comments or suggestions welcome.
[1]: https://saveoursecrets.com [2]: https://docs.rs/sos-sdk/latest/sos_sdk/
A lot of people seem to be acting like this is a really big deal. Is it cause it’s available on windows now?
I guess Apple just wants it to be more obvious that hey, you have a password manager already.
They took VC funding to pivot to enterprise, anticipating that OS vendors would integrate basic password management features (what most of their usage at the time) into the OS.
So the consumer experience has been de-prioritized. I will not be renewing my 1Password subscription.
Moreover, I shouldn’t need a cutting edge microprocessor just to look at my saved passwords. Multiplied across 15 million 1Password users, even 1 second amounts to about six months of collective time wasted for each app launch.
I would never hire any developer who disregarded their users’ time, UI experience, and computing resources so blatantly.
In my perspective clearly the blatant disregard for UI experience is wanting to develop native apps just for hypothetical RAM savings or similar ideological preconceptions on performance that are not real or relevant in practice.
Electron apps are now everywhere because THEY WIN. Figma, Slack, VSCode all succeed in large part thanks to being Electron apps. HN denial of this simple fact is copium
Fast food is everywhere because it's cheap and fast. And diabetes and heart disease rates are skyrocketing worldwide. Is that "winning" in your eyes?
Bitwarden has been lagging in implementing any consumer features for some years now (custom item types has been on the roadmap for six years and is still not done). Except for secure notes in Bitwarden, I don’t think you’d miss anything else in this app. Bitwarden is spending money and focus on the enterprise, just like 1Password has been. For the consumer segment, neither of these are good enough now.
This is actually the reason why I like Bitwarden. They don't seem to be constantly trying to push unwanted features on me. I've always been a fan of the first "rule" of the Unix Philosophy: do one thing well.
But it might make other people who don't use a password manager start using one.
I love my mac and I love my pixel phone but sometimes being a Mac + Android user just sucks.
Passwords are saved on your device.
Curious to see how this ends up impacting competitor's businesses or not though! If Apple gives themselves access to a bunch of integrations and APIs no one else can that sounds like they would be abusing their monopoly power...
I use 1pass across all platforms.
There are groups that can do that coercion (eg. US and CPC governments), and there may be support staff et all in Apple that can get the same access.
For the same reason, I was unhappy that Keychain.app is auto synced to iCloud (and as per a past thread, even if you disabled it it may be reset).
So, of course, I don't have to use their app. Except that I suspect it will be built into the OS in a way that makes it hard to avoid, such as Keychain.
I would love it if there was a way I could setup my self-hosted BitWarden instance to be as integrated as Keychain is, and not use Apple or Google for passwords.
Apple was part of the PRISM program, we know they gave access to our data for mass spying.
I always end up looking in the Keychain app to be sure to find what I'm looking for, but I dislike that app because it often takes several password entries to get to see a password.
I assume the Passwords section of System Settings is only pulling up a subset of these, but I haven't upgraded macOS on my personal laptop in a long time (I'm on 12.4), so can't verify easily.
Is the reason for fewer security breaches perhaps that the data wasn't as valuable to attackers (until now) ?
It may be my own ineptitude, but I won’t use it again.
It doesn't work as a standalone Chrome extension in the way that 1Password or Bitwarden do, for example.
Also if those two apps didn't have a product feature map way ahead of apple then they were doomed from the get go. They must have known something like this was a significant business threat if not existential risk...
I'm a bit nervous after hearing about people having early adopter issues.
Hopefully there is some sort of fallback if something extreme like a house fire manages to destroy all of your personal devices at once.
This is already addressed and has been since Apple first launched support for passkeys. See the “Recovery security” section of the “About the security of passkeys” support document here: https://support.apple.com/en-us/102195
If anything 1password has proved to me that an Electron application can eventually be pretty seamless. I have been very impressed in MacOS and Firefox.
Isn't that like against every rule of every bank ever everywhere?
How will apple protect all of your password data in this case?
Will the setup allow for an additional password to prevent hackers from gaining access?
+ Can't beat convenience.
+ Cross platform
+/- free if you don't need mobile version
- Closed source
(no affiliation)
+ cross-platform
+ free as in beer
+ free and open-source software
Can't really comment on convenience, I moved from LastPass, but it has worked well for me.
Only have to memorize 2-3 strings and more secure than a password manager since there's no third party in the loop.
Password Managers are a huge man-in-the-middle and liability in other regards (e.g. you don't have it present on a given device or on hand).
SSO from a single set of credentials is a much better solution. Multi-factor biometrics even better (outside of PII sensitivities)
Unless you are directly, personally, targeted no hacker will waste the time trying to reverse engineer your algorithm... they'll just go on to brute forcing the next hash in the list.
And most people only have a few services that need to be truly secure anyway, which would use non-derived passwords (if they hack your netflix or spotify, who cares? Call support and get it back)
Password managers have had many exploits/failures over the years. You introduce so many points of failures bringing in a third party.
Your gibberish password with random symbols/characters isn't any more secure than a more memorable one of a similar length.
1. It's now easier to access passwords on the mac because you no longer are forced to use Safari to view passwords, nor have to sort through the technical entries/certificates in Keychain Access.
2. The app surfaces a prominently positioned button for one-click sharing and exporting of passkeys/passwords, whereas existing methods significantly lack in comparison.
3. It's the opposite of lock in to consolidate all types of passwords into a single consumer-level interface, when the alternative was hunting for them across the various apps and system panels.
4. It works with iCloud for Windows for cross platform support. Which also means you don't need a mac to participate in shared password groups.
Your passwords haven't been bound to Safari for quite a while. You already had to use the Passwords app found in Settings. Both Safari and Keychain Access have controls to allow you to open the Passwords app (the Settings one) from within them, but it stands independently.
The new Passwords app seems to be the old Passwords app with some refinements, new features, and moving it out into a more familiar location rather than it being hidden away in Settings. You might say this is Passwords v2.
I meant this in the sense of addressing people that stated that putting a password manager in Safari is vendor lock in, and accessing passwords via other methods such as the password pane in Settings as a bridge too far, along with describing that panel as "hidden" and using "dark patterns".
On the balance of information it seems clear that moving passwords to a separate app that is easy to access, navigate and share passwords (including across platforms) is the opposite of lock-in.
I only use 1Password instead of native because I needed something that worked on Windows. Will need to see how well that works, but I just don't see a personal reason why I would not just use this when it works so much better on my iOS devices.
It's the same reason I don't trust Google with all my picture or documents. At any point in time their algos can flag your account for wrong reasons and that's the end of your digital life.
There is still a place for password managers, but if I'm the LastPass CEO, writing is on the wall with this announcement... They will see a large exodus of customers that use Apple OS.
You have a completely free choice to use 1password, BitWarden, KeePass etc ..... Apple is not stopping you.
Forcing all browsers on iOS to use Safari is a different matter.
I don't trust 'Passwords'.
These are the reasons why I don't use Apple products despite the great hardware.
https://support.apple.com/guide/security/icloud-keychain-sec...
Safari? Not on Windows.
Apple Music? This actually has a Windows client. I'm not sure how good it is. But Spotify supports Windows and even Linux.
Apple Password Manager? Will this be tied to iCloud? Will I be able to use it on Android? If I no longer have an iPhone will it be a pain to maintain and use?
A dog cannot serve two masters. A company like Apple doesn't see any of these things as a product. They're a means to an end: to push the iPhone platform (and hardware sales). That priority will always trump the interests of a product like this.
It's also why I refuse to buy more into Google products: it's too much of a risk to lose access to everything if Google wakes up one day and decides to suspend your account with no recourse other than making enough of a stink on social media such that an employee will actually look into it.
People don't want everything tied to one identity, one service, one login.
There is a sense that Swift has opened up cross-platform app initiatives at Apple that they wouldn't have done just a few years back.
I don’t see why that would be a big problem for Apple.
As this article explains, this isn’t new functionality. It’s (mostly) a new UI for existing functionality, to make the hardware they sell and make lots of money on more attractive.
Apple has tried various approaches of surfacing this functionality (eg the passwords panel in Safari and again in iOS’s settings app). This just seems to be the app-agnostic way of providing this functionality to everyday users, and probably a good thing as platforms move away from passwords.
No, the commenters I'm referring to are ones that think Apple including a password manager is anticompetitive lock in, and other similar comments that are clearly unaware that this is not new functionality.
Your comment has zero bearing on what I posted. Apple themselves use 1PW
Which is also only available for Windows, as far as I know.
Other people can make different choices. This doesn’t seem like a crisis.
Of course, I'm talking about, for example, work environments where you may be stuck with a Windows PC, or have to use a corporate-owned Android device for your phone...
Trick I do do sometimes is, just WhatsApp the files to myself and attach them from my phone
I think this is exactly what _most_ people want.
With password management specifically, Apple has had a Chrome extension available for a while now which has allowed me to use it on other browsers/platforms. Not ideal, but good enough for most.
On top of that, they don't lock you in with passwords. You can easily import and export your passwords, just like you can with 1Password.
Apple Music has had a web client for a long time. iTunes has been on Windows for 20+ years and Apple Music was supported via that until recently when they built an Apple Music specific app.
https://cider.sh exists and is in various distro package managers already too.
Now that many sites are moving to passkeys or TOTPs, it would be great if Apple could not lock users in there as well.
> Apple has had a Chrome extension available for a while now which has allowed me to use it on other browsers/platforms
That's only on Windows and requires you to install iCloud tools locally, right?
The king of wishful thinking has entered the chat.
It’s that for a service that you only have a need for, a few times a year, mandating 2FA is an unnecessary hassle that can lead to user frustration.
I’ve experienced the same with Gitlab. I rarely use Gitlab and don’t have anything important hosted there but when a project I was a member of enabled 2FA for all contributors, it made my Gitlab account completely frustrating to use.
Typical scenario: I’m trying to do something brief on Gitlab that requires me to be logged in so I login then get shown an interstitial page saying I cannot proceed until I enable 2FA on my Gitlab account. Every action I attempt while logged in will fail unless I either enable 2FA or remove myself from the project that enabled mandatory 2FA after I was added.
GitHub’s 2FA implementation is night and day better than Gitlab’s but I imagine the user frustration must be similar if you find yourself suddenly having to enable 2FA because a GitHub org you were already part of mandates it.
That said, the sign-in flow with a Passkey and BitWarden is great. Click "sign in with a passkey", click "confirm", done. No username, password, or 2FA required.
One day I hope BitWarden implement my suggestion of not requiring that second click if you only have one key.
I wonder if I can delete my account and create it anew with the same email and (probably) a different username.
https://chromewebstore.google.com/detail/pejdijmoenmkgeppbfl...
I have been stung a few times by apple locking my data within their ecosystem (eg I can’t export my notes from iPhone out without a Mac, or MANUALLY copy each note which is crazy) so I refuse to use any of their apps or features unless I own my data
In theory you can export the data to some out-of-ecosystem backup device on a regular basis, but we all know that most people are not going to do that.
The backup situation is terrible - Mac only - Only Passwords (no passkeys) - Only items you created (so nothing shared with you, even if you own the shared “group”)
In short your only option is one at a time manual export
Like seven people replied to say this, but they're all missing the trick.
Most people want this because they're guided to want it. If you show people the convenience but not the risk, of course they want something with an advantage and no apparent disadvantage. But the disadvantage exists, it's just not immediately obvious.
Then some corporate machine learning algorithm decides that it's your day to have a bad year, or the screws only get tightened after you're already locked in, and the regret comes some time after the decision is made.
Whereas the nerds who can see the inside of the machine are aware that this sort of thing happens and their response is no thank you. A starkly different preference from the people paying the most attention is a troubling sign. It's the early stages of this:
The thing that gets me is that people then defend the practice because it's likely to be successful. Lots of unsophisticated people are going to put all their eggs in one basket and then have a bad time, which is a result we should be trying to prevent, not defend the people causing it because they're likely to turn a profit. Companies making money on information asymmetries and the misfortune of others is a flaw we should be looking for ways to optimize out.
Suppose your Apple ID gets compromised. The attacker is a jerk and decides to remote erase your device. Then they use your account for black hat stuff and get it permanently banned, or just erase everything on iCloud too.
If the password manager was a different service then you'd still have the password for that service and could get in and recover your accounts on everything else. If it isn't, where's your stuff? The device and the cloud backups are both gone because they were both tied to the same compromised account.
Or you just break your phone and then realize you don't know your password. You can reset your password with your email, so now you just need your email password, which is iCloud, which is the same password. Uh oh.
Whereas if your eggs aren't all in the same basket, you can get a foothold somewhere. If you use a third party email service and haven't forgotten that password, you can still get your email on another device. If your password manager backs up to a third party service or your very own Raspberry Pi, you have access using a different set of credentials than the ones you forgot.
- A lot (most?) people’s Apple Account name is actually their main email address (e.g. Gmail), so they would still control their email address even if their Apple Account was compromised.
- You can still recover your Apple Account and iCloud Keychain without any devices (e.g. if phone broke like in your scenario).
- Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
But the login for the Gmail address is a passkey that's on the Apple account...
> - You can still recover your Apple Account and iCloud Keychain without any devices (e.g. if phone broke like in your scenario).
So what's the point of passkeys if you can get access to them without passkeys?
> - Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
How can something be protected when the thing that controls access to it has been compromised?
A passkey is just a replacement for a password. Google (and other apps/websites) have account recovery processes for users who get locked out of their accounts. The way you get back into your Google account doesn’t change much just because you’re signing in with a passkey vs. a password.
Account recovery is a problem that service providers have to solve (and do solve) regardless of whether a user authenticates to their account with a password or a passkey.
> So what's the point of passkeys if you can get access to them without passkeys?
Some huge benefits are:
1. They are highly phishing resistant. Unlike passwords and popular forms of 2FA (TOTP and SMS), users can’t be tricked into sending their credential to a fake/malicious server. A passkey is bound to the server domain at the time the credential is created, and your OS/browser will simply not send it to the wrong place.
2. There is no credential for attackers to steal from servers in the case of server breach. This is because only a public key is stored on the server, instead of password hashes (or worse, plaintext, if the app/website developers don’t know what they’re doing).
3. Passkeys are guaranteed to be unique and secure. The same cannot be said for passwords. Even a password manager cannot guarantee that every single credential stored in the password manager is both unique and secure. And password complexity requirements often make it a painful game of trial and error to create a secure password, even when using a password manager.
4. Because of annoying password complexity requirements, the process of creating a new password can be annoying and take up to a minute or two of fiddling around, even when using a password manager. With a passkey, the process takes as long as Face ID or Touch ID (or equivalent on other platforms) every time. Every single credential creation and authentication is a fantastic user experience (both fast and easy).
I suggest watching Apple’s WWDC videos. There you will find a very very in-depth answer to this question.
All of the points I’ve made above (and more) are covered in the linked videos.
Move beyond passwords: https://developer.apple.com/videos/play/wwdc2021/10106/
Meet passkeys: https://developer.apple.com/videos/play/wwdc2022/10092/
Deploy passkeys at work: https://developer.apple.com/videos/play/wwdc2023/10263/
If you won’t watch any of the above then you should at least read the FAQ on passkeys on the FIDO website here, which should answer many of your questions:
https://fidoalliance.org/faqs/#PasskeysFAQs
> How can something be protected when the thing that controls access to it has been compromised?
This is answered in the article I already linked above. Here is the link again.
About the security of passkeys: https://support.apple.com/en-us/102195
Specifically, carefully read the following sections titled “Synchronization security” and “Recovery security”. The short answer is that gaining access to the user’s iCloud Keychain contents requires more than just having access to the Apple Account.
> 1. They are highly phishing resistant. Unlike passwords and popular forms of 2FA (TOTP and SMS), users can’t be tricked into sending their credential to a fake/malicious server. A passkey is bound to the server domain at the time the credential is created, and your OS/browser will simply not send it to the wrong place.
So why does my browser or password manager send saved normal passwords to a different domain than the one they were saved for? This is not a limitation of passwords but of the software that encourages saving passwords. It didn't need switching to machine only passwords to fix.
> 2. There is no credential for attackers to steal from servers in the case of server breach. This is because only a public key is stored on the server, instead of password hashes (or worse, plaintext, if the app/website developers don’t know what they’re doing).
What has stopped developers from using irreversible transformations on stored passwords in the past? The math was there.
> 3. Passkeys are guaranteed to be unique and secure. The same cannot be said for passwords. Even a password manager cannot guarantee that every single credential stored in the password manager is both unique and secure. And password complexity requirements often make it a painful game of trial and error to create a secure password, even when using a password manager.
If it's generated by software, any software should be able to assure uniqueness. This is again a failure of saved passwords / password managers.
> 4. Because of annoying password complexity requirements, the process of creating a new password can be annoying and take up to a minute or two of fiddling around, even when using a password manager. With a passkey, the process takes as long as Face ID or Touch ID (or equivalent on other platforms) every time. Every single credential creation and authentication is a fantastic user experience (both fast and easy).
Yes and here we get to the elephant in the room.
You become dependent on an easily stolen or destroyed device for authentication. It is a fantastic user experience until you're a plane flight away from home, your phone gets stolen. Your passkeys are safe in the secure enclave. Too bad you can't access them any more. How do you get home? You don't have any other devices to prove your identity, if you even have backup devices, they're at home. The flight options are in an app that you don't have the passkeys any more for. Your flight may get canceled or rescheduled and you have no way of knowing. If you didn't bring any physical credit cards or backup cash, you can't even eat.
Passkeys are all fine in your average techie environment, but can be a disaster outside it.
Any kind of authentication method that relies on a string that can possibly be manually typed into a box by an end-user can never be made to be highly resistant to phishing.
> What has stopped developers from using irreversible transformations on stored passwords in the past? The math was there.
I don’t understand what point you’re making here. Are you saying “why didn’t people create a different standard than WebAuthn?” or are you saying “strong password hashing methods exist, so why do so many websites use bad ones”? Or are you saying something else?
> You become dependent on an easily stolen or destroyed device for authentication.
No, you don’t, because passkeys on Apple platforms are stored in iCloud Keychain, which syncs across all your devices with end-to-end encryption. They’re not solely on your phone.
> It is a fantastic user experience until you're a plane flight away from home, your phone gets stolen. Your passkeys are safe in the secure enclave.
They are stored in iCloud Keychain, not the Secure Enclave. And you can recover access to your iCloud Keychain is even if you lose your phone, and even if you lose all of your devices.
> The flight options are in an app that you don't have the passkeys any more for.
You could just go through the account recovery flow for the airline app to regain access to your account. Whether you use a password or a passkey as your primary credential for logging in has very little to do with account recovery logging into an airline app. The app needs to continue to handle users who get locked out of their airline account for a variety of reasons.
On which device? You can't use a public pc (or a local friend's) because you'd need to get your new passkeys on it and that's not safe.
Buy a new laptop/phone on the spot?
I'm going to make up a new conspiracy theory that says this push for passkeys is there to sell more devices, because shared devices aren't safe any more.
But this is an example of not putting all your eggs in one basket. An all-in Apple customer is using Apple as their main email.
> You can still recover your Apple Account and iCloud Keychain without any devices
This assumes that you remember your password, and that the attacker has not changed your password, and that the account has not been permanently disabled for abuse.
> Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
"Protected" means someone needs more than just the iCloud account to get access to them, not that you can re-download them if you lose access to your iCloud account.
It also depends on how your account was compromised. For example, if a thief observes you entering your unlock code and then steals your phone, they have the device they need to access all your passwords too.
Someone use their phone as their only computing device (e.g. only other device is their school or work computer).
Their phone dies and the shop convinces them to go for a Pixel 9.
How screwed are they if everything was in iCloud, vs they were using 1Password ?
> How screwed are they if everything was in iCloud, vs they were using 1Password/{own,next}Cloud/Evernote/Meta/Dropbox/web apps...?
That would be a more appropriate picture.
> How screwed are they
Not much. Annoyed maybe but as long as they have access to their email and phone number they can reset their passwords.
What about the other way around? If a person broke their Android phone and a friend convinces them to move to Apple? You could argue that then they may have everything in Google and that they could log in on an Apple device with their Google account and use Chrome and Gmail and whatnot, but then they'd be storing everything in Google.
What if Google sunsets a product? Or Google unilaterally decides to close their account overnight with no human in reach for support?
I'm all for interoperability. I do get the risks at hand. But the hodgepodge of separate solutions forming a duct-tape held system is hardly usable for the "mere mortal", let alone integrating the together in reliable ways.
People want technology to disappear so they can go on with their lives and do stuff that matters to them (which integrating platform-independent third party solutions is not). So "all eggs in same basket" is an extremely valuable feature for most.
At best they spend hours and hours up to days resetting the passwords for all the account they ever had. Looking at my password list, there's 700 or them, it would take me a week of my life, if I ever get to do it at all.
At worst they actually can't access their email and it's the end (or a week or two of back and forth sending official documents to get it back ?)
As a first point: they don't have to go all Google. They can have a Google account solely for their phone, and have everything elsewhere. That's a nobrainer as long as they have a solid password manager. You call it hodgepodge, but that's just what we've doing for the last centuries.
The issue of a service unilaterally killing an account isn't limited to Google. Apple will also kill your account if they assume you misbehave, and you might get someone on the phone, while not getting any resolution.
Do we hear it more about Google ? sure. But Google is also in the biggest service provider on earth at this point.
Someone uses their phone as their only computing device.
Their phone gets destroyed or stolen while they're far away from home to require a plane flight to get back. Perhaps stolen along with their ID.
How do you recover when your logins are passkey only and the passkeys are gone with the stolen phone?
The difference is just that because of the halo effect they dont blame Apple for the shit that doesnt work. If there is a 3rd party tangentially involved they blame them instead.
It's a binary and you generally know the answer straight away.
Some people dislike it because they enjoy looking for answers and the freedom to change how things work. Others like it because they don't want to spend their time searching and mucking about with configurations.
The general mechanism for free software to be developed is for the individual users to make modifications. Not all of them, of course, but the ones who know how to. Someone sees something wrong, fixes it.
Apple interferes with this. If you don't like an app on your iPhone, even if it's open source, you can't just make a minor change because for that you have to pay $100/year and buy a Mac and all of this friction that discourages people from doing it. And then upstream doesn't get the little change (times a thousand individual users with an itch to scratch), and the one-time contributor doesn't become a repeat contributor either.
Not only that, you can't distribute a half-finished app to the public -- even if it's free -- because it wouldn't pass review. But then you can't get any users who might help you to finish it. So the state of open source software on the iPhone is a shambles, because Apple neutered the primary mechanism for free-as-in-speech software to become any good on their platform.
Compare this to Linux on a PC where simple things are about as likely to "just work" as they are on a Mac, more likely to do so than on Windows, and weird and complicated things work better than on either of them because even though they're not always easy they're very nearly always possible.
Which is the perpetual sham of "it just works". Simple things are simple everywhere because they're common and well-supported. Complicated things are often difficult, but some platforms make them prohibitively difficult or simply disallowed, and people confuse this with "easy" because you don't remember spending time to make something work when you can't. But that's not actually an advantage, because you're not obligated to spend time on something that doesn't immediately work, but the option to choose to is valuable when sometimes it's worth it.
I believe this whole Apple vs Linux debate is perfectly analogous to the West vs East Germany debate, to the point that almost all intuitions/arguments for the latter are perfectly reusable in the former
As opposed to the centralized service that will kindly misconfigure it for you, or just discontinue it out from under you, or ban you because of a false positive, or ban you because of a true positive because you unwittingly violated their broad and ambiguous terms but you're still just as screwed.
> I believe this whole Apple vs Linux debate is perfectly analogous to the West vs East Germany debate, to the point that almost all intuitions/arguments for the latter are perfectly reusable in the former
The fallacy of Soviet Communism was the fallacy of central planning. The Party decides what's good for you and The Party is infallible so if you try to resist you'll be punished. Freedom of choice is heresy. Divergence is verboten.
Does that sound to you like the typical Linux user, or like Apple?
Do I wish they worked better? Of course. Have I experienced those same problems with Android / PC? No, but different problems existed.
The people compiling everything from source and messing with kernel modules are doing it because that's their hobby.
Ahhh so you want the public to do your QA for you and don’t mind interfering with their productivity when the first iterations of your software are a buggy mess? I am ok with Apple trying to keep the pests out of their garden, or providing a lockable gate like TestFlight where I can go into a testing situation with my eyes wide open and risks well understood. Your open source devs are not always great at disclosing the fact that their software is half baked and people install expecting a robust app and finding instead…a load of crap
"Open source" means developed by the public. The public isn't just doing the QA, they're doing the entire thing from the first line of code. Which is exactly the problem with Apple's interference -- they want you to have a finished app before you can share it with all the people who might have been willing to help you build it.
> TestFlight
And we're back to intentionally putting up barriers to exactly what open source needs to succeed.
Maybe 1% of users are programmers, and 1% of those might be contributors. But that's fine if you have a million users -- less than 0.1% of the world population -- because you could have a hundred contributors, which is enough to get something done. Which in turn allows you to improve and then get ten million users etc.
Testflight caps the number of users at 10,000. Now you've got 1 contributor instead of 100 and when that's not enough you're sunk. Meanwhile the "beta" is forced to expire after 90 days which creates friction for the users and makes them more likely to abandon you.
> Your open source devs are not always great at disclosing the fact that their software is half baked
People will figure this out pretty quickly when they try to use it. But then that's the point -- you try to use it, it sucks, but you can fix it yourself. The intention is to have this happen and then the app improves for everyone.
Then you find that it’s uninstallable and you now have a fooked computer where you have to wipe your whole goddamned system to be rid of the POS you just installed. Hopefully you imaged your system right before you DL’d and installed the offending app…so you’ll only lose a few hours instead of a full day this time for your effort. However, you can feel good that you helped “develop” an open source software that almost no one will ever use like the good little netizen you are.
Yeah, no thanks. I’ll take my walled garden and it’s vetted and well behaved apps all day long.
I never understood how this argument even makes sense. It sounds a whole lot like you're upset that most normal people don't care about and don't want what you want.
And maybe there are some people who, faced with the risk of losing all their stuff, conclude that maybe all their stuff isn't that important to them and they don't have time for this YOLO! But there are even more people who never even consider the risk, and it seems like somebody should be looking out for them instead of people just saying "shut up nerd, normal people don't care about whatever you're worried about." Uh yeah, that's the problem, they're not made aware of it until it bites them on the ass and anybody who tries to express the concern on their behalf is told to keep their foot away from the hose of the money vacuum.
You're overblowing the harmfulness, I'm not even sure what the argument is.
Prove to me you deserve to be called a "nerd."
Same shit with the Microsoft Netscape trial, really. People didn't want alternatives because Microsoft went absurdly far out of their way to stop fair competition on their platform. Now we're seeing the same shtick, again, on a different platform.
1: https://www.nytimes.com/2018/02/16/opinion/sunday/tyranny-co...
Now consider what happens if people do the opposite. Instead of defending convenience as an end unto itself as Moloch would have it, you create friction against bad choices. Complain about them, refuse to assist your allies in making a mistake. Do things that make bad options less convenient and redirect people to better choices.
People will still do what's convenient, but now the more convenient thing is the better thing.
What about making "the right option" better instead of making the "the wrong option" worse?
Of course, you can also improve the right option independently of that, e.g. by making contributions. But now we're back to "Apple interferes with this by making it harder to tinker."
And look, I don't feel that libertarians (or, let's kill the analogy, FOSSers) are always wrong. Of course they're right about some things; they're just wrong about so much more than they're right about, its like a 90/10 split, its not close. I think the cognitive dissonance is something similar to chesterton's fence: FOSSers don't respect the massive profit-motivated and closed-source companies and systems which, at best, make pockets of productive, awesome open source possible; but more realistically and worse those pockets are just the software version of "buy a Subaru because we donate money to cancer research", they're free labor/recruiting/tax writeoff/community goodwill campaigns by gigacorps, and its all just profit at the end of the day.
Nerds who can see the inside of the machine and are aware that this sort of thing happens is literally just stating in different terms the stereotype type-As assign to nerds: that they don't understand anything but the technology [1].
I just wanted Passwords to be its own app because the Settings applet(?) is obnoxious to interact with in some scenarios. My passwords are already all in there.
Now, I use a Windows laptop too and would love for Apple to make the Passwords thing work there too. It probably won't :)
I think that what is convenient to you, or to fellow engineers, is not what is convenient to the mass public or non-technical people. Very simple solutions, which are often platform-specific, tend to be a lot easier in many cases -- not necessarily all cases, but when something is built-in to a device or OS, this does remove some burdens from users.
Indeed, this generally works better than vendor-specific technologies as soon as you encounter the real world where different people have different stuff. Safari works just fine with Linux webservers because they're interacting using open standards. Then you want to get your Mac to work with Active Directory and it's a frustrating mess because it's not open standards and neither vendor wants to facilitate the use of the other's proprietary technology.
> I think this is exactly what _most_ people want.
Until they don't, which always happens sooner than you would think.
I couldn't agree more. I use Google's password manager because (1) it syncs everything (2) I already use Chrome everywhere (3) I can't be arsed to set up another password manager that is generally inferior in terms of integration.
I don't care for the FOSS argument. I just want stuff to work and work easily.
Plus, I sincerely believe Google is 'too big to fail'. If somehow Google gets hacked and my plain text passwords all get leaked, it means something huge has happened and we're all massively screwed anyway. So, whatever.
Google might be too big to fail (I don't think so, but could be wrong).
The flip side of that is that google is too big to care. We all know from countless reports that they will evaporate your google account and everything ever associated with it, for no reason at all and zero chance of you ever being able to reach anyone to fix it.
I can't see why anyone would risk anything of value to such a platform that can destroy all your content at any second for no reason with no warning.
The only real solution to this is to self-host, locally. Which isn't feasible for the vast majority of people.
While that's a great solution, it is not the only one.
Do business with providers that are not too big to care. The ones where you can call them up and talk to a real human who is empowered to fix your problem.
It's better in every single way.
No. Please stop being speaker for most of the whole world.
There are people, including me or my wife who is not technical at all, who will never use anything similar from Apple. Or any similar SSO/access/security platform. Google and FB tried that decade+ ago, only fools fell for that regretful trap if the service has actually any long term added value.
There are demographics where Apple has dominance.
My work MacBook was pulled from an original Air from something like 2015, to a 2017 Pro and currently my 2019 Pro.
So I’ve got apps installed on my Mac that have been installed damn near 10 years ago.
Ditto my home 2015 Pro was later on migrated to a M1 Air. Hell, I’ve still some 32 Bit Steam games that still somehow run on my Air (least Steam tells me they’re 32 bit).
We could play this game ad-infinitum, each finding a level of supposed “openness” but the basic facts are that neither Windows, nor MacOS are truly open.
If you want open, then Linux is always going to be in the answer somewhere. Not MS Windows. And not Apple MacOS.
MacOS is bloated anyways; they might as well use that bloat for something important like backwards-compatibility and not zombie-code left over from the PowerPC era. That's just an objective failure, on Apple's behalf; they break software support more often than Microsoft and even Linux at this point. A professional OS really has no excuse to break someone's software and leave it broken. Even Microsoft gets that.
So... yeah, you know what? I do want it to be bloated with drivers, because whatever they're stuffing it with right now clearly isn't working. I don't trust Apple to write or maintain a long-lived successor, I demand third-party alternatives I can maintain myself. Give me more options for writing and delivering software, or else I am going to continue ignoring MacOS as a build target for the foreseeable future.
As such both Windows and MacOS are closed source.
As for “opening up the OS” both are pretty gosh darned flexible and extensible wrt other features.
However being based upon a BSD core, MacOS has had access to the Unix command line natively since forever. For Windows one used to have to rely on CgyWin before the virtualized WSL platform came to be.
Whilst MacOS has the somewhat opaque ~/Library for storing user settings and data, it pales into comparison to the massively Opaque Windows Registry.
I’ve had had very few issues fixing app install issues with my Mac - with Windows I’ve had more than one occasion where I’ve had to do a complete reinstall of the OS due to the Registry being totally hosed to the point I couldn’t reinstall apps again.
In terms of the machine Windows is way more open in that you can use what hardware you want. But yeah the software is closed source.
So waters were indeed muddied.
You can run Windows almost on any hardware. So it is much more open in general.
You can equally run almost any imaginable software on both operating systems (if we ignore the performance), but you have extreme difficulties to run macOS on most hardware.
I think Windows is up there with the open source OSs (Linux, BSDs, etc) on regular PCs are at the same end of "run anything you want from wherever you want it", iOS devices are at the other extreme of "only run things approved by Apple", Android devices are pretty closer to iOS because they make you jump through hoops and potentially lose access to various functionalities to install certain things or gain root access. Modern macOS, as far as I understand, is somewhere in the middle: you have to jump through quite a few hoops to install certain kinds of software, and a few aren't permitted at all I think (unsigned kernel modules?).
M Pro series are probably the best laptops on the market, and if people keep buying them, is the price too much?
MacBook Air is actually quite well priced for what you get.
Yes, and they should have it. As open source software that a free market of hosting companies can compete on price and quality for. Not as closed source software hosting by a Big Tech oligopoly.
You should be able to host your info on a server of your choice, encrypted end-to-end from your devices. That server is the one which should collect payments, manage subscriptions, do access control checks, and deliver data to others. That server is the one which should send notifications and push news updates to your devices as well as subscribers’ devices. You should always be able to migrate easily to another server, or use several at once, as fallbacks.
People have learned helplessness (“oh I wish Twitter would add feature X”, “oh, I guess we all have to get a Google Plus account”, “oh, sucks that Google Plus and all my data and social connections there are going away”) because open source developers didn’t stick around long enough to make something that is good enough to compete with it, and is decentralized and federated.
I can count on one hand: Mastodon. Bluesky.
I am working on fixing it: https://github.com/Qbix/Platform
Larger vision for 2025 and later: https://qbix.com/ecosystem
This is what they think they want, until something happens and they are forced to move out of the walled garden, and have to replace everything.
But, admittedly, that's Apple's bread and butter, and they've managed to avoid big controversy so far...
I see many comments replying to the above statement, and I am no exception.. what about the saying that goes: "Don't put all your eggs in one basket"?
I think it's a lot more important to decide who you want to trust.
The problem is that there are a lot of small apps that end up being scams. Or they end up selling their software to scammers. Or they just don't have the ability to properly secure their system (LastPass).
Apple has kind of made a name for themselves as a big company that cares about privacy and is serious about security. And they don't have the reputation for totally screwing over their customers randomly like Google.
I can see a lot of people making the pragmatic decision to just keep trusting Apple instead of figuring out which other company to trust as well.
This is EXACTLY what people want. Please remember that HN is not a cross section of the general public.
Yup. I need to constantly keep that in mind, when I’m designing my software.
Very often, the fact that I like it, is a negative.
Incredible insight. Too often I'm building something and it rises in complexity precisely due to me wanting extra features that might be very niche and technical in nature, so I too must remember to not bloat the product and make it much more streamlined.
I don’t need idealism. I need my mom to be able to figure out how to log into her bank without having to call me every time. The more that’s tied to a single ecosystem the better.
You made the same mistake as the person you're refuting, only worse because you added "exactly" as if case closed.
Here's another take: "People" want different things. They listen to different music, have different opinions, buy different cars, have different tolerances of when a car needs washing.
My non-technical Mum refuses to use online banking; my non-technical Dad loves online banking. My non-techie sister loves issuing verbal commands to her smart speaker; my non-techie Mum refuses to speak to devices & switches her TV off at the wall every night.
The only "EXACTLY" is in marketing efforts trying to convince you of that state.
So I'm not sure how many people will actually use this just because of this friction.
Branding a solution as Apple isn't a guarantee of success. If it were, we'd still have Safari for Windows.
This is what OAuth attempts to do, and most users and devs I know like it.
I'm well aware of the risks of putting all eggs into one basket. I'm already doing it with 1Pass (albeit with external MFA for some sites), so I see no difference with letting Apple manage it.
Counterpoint from an interesting source:
https://gist.github.com/nckroy/dd2d4dfc86f7d13045ad715377b6a...
An Android app would be nice as well, but I doubt that many people use both iOS and Android devices[1] (or concern themselves whether they will be able to switch platforms easily).
[1] Android devices as in devices where password manager is desired, not as in 3 Billion Devices Run Java
People literally want everything tied to one identity, service, and login. You are almost totally wrong. People do sometimes want to switch to something new when they feel what they've bought into hasn't met their expectations or has fallen behind in innovation. And guess what? Apple in very limited ways actually locks people into things like passwords, files, photos, notes etc. Their entire ecosystem is pretty easy to migrate away from, I've done it several times. Theres an import/export tool for most everything.
After this year you probably can't even say they are locking people into their ecosystem with iMessage.
There's a difference between Google's products and Google's services. You can use either one without the other. I am a happy user of Google hardware, and am even happier to be almost entirely extricated from their services.
A company does things for the sake of profit.
I would immediately leave Windows in the dust if gaming was equally supported on macOS. Maybe in the future, let's see. For enterprise work, MS365 is also really central and it's basically not possible to work without Excel, PowerPoint, Outlook and Teams even if you personally prefer other software (I don't). They're fine on macOS or the web interface but clearly neutered in comparison to Windows native.
It is absolute garbage, but luckily the legacy integration in iTunes for windows still (sort of) works.
No, it's not Apple's problem, let alone be a big problem. Apple does not like to provide services for free on other platforms and isn't even very good at doing it for paid services. This passwords app is meant for those who use and depend on Apple's ecosystem, not as a generic competition for other password managers.
You can't piss Apple off, until you do.
I personally haven't heard of people's account getting randomly shut down for whatever reason for either company, but I'm sure it happens.
With 1Password, I can only really think of payment issues (ultimately, everything within your account is just a matter of sharing a binary blob they can't read - maybe if you try to use it as a file store and the size becomes excessive), whereas with Apple, I'm not entirely certain what they could read on my machine that could trigger them (hopefully with Advanced Data Protection, this is a small surface area).
But you are right, both of them could cause headaches.
Though, there' a 3 minute gap, I had not seen your comment (hadn't refreshed the page) when I typed mine.
You'd be surprised. People want a neat solution so they don't have to deal with multiple nuissances.
They worry less about vendor lock-in (if they even understand the issue unless it's bitten them, and then they can consider the costs of switching as totally normal and expected, similar to how they just go find app replacements for platform-exclusive software).
What exactly is wrong with paying $10 per year for a well done product?
I paid for my full version of 1Pass way back when, and upgraded all the way through to v7. It was a one time fee and used until they broke it.
I never said refused to pay for it, but a monthly fee in perpetuity is just ridiculous to me.
I'm willing to pay for a lot of software, but the costs are certainly real (especially in aggregate), and I try to be mindful of whether it is worth it to me. I would definitely pay $10/year for a password manager. I currently pay $36/year. Would I pay $100? No. But I'm not sure where the cutoff is.
And then I have to do this for every pricier piece of software. (For all of the lower-cost, one-time payments, little apps, etc. I just pay and move on.)
When it comes to a password manager, I appreciate having constant access to updates. That isn’t feasible for one-and-done code.
That said, it’s 1Password’s bugginess that will have me looking at Apple’s offering. (Particularly how it performs on non-Safari browsers, e.g. Orion and Firefox.)
It seems nuts to me that you expect someone to provide you a service for free?
The point is maintenance is an ongoing expense. Pretending it can be baked into a one-off purchase price is nuts, unless one is willing to buy that software caveat emptor, as in if it has a critical bug, sorry, you need to upgrade to have safe software.
For a game, that seems fine. For a password manager, obviously not. That said, enough people don’t like this to give Apple an advantage in amortising payments that users cannot.
My wife and I have talked a bit about this recently but haven't implemented anything yet. (I use 1Password, and she doesn't have access other than a shared vault, and vice-versa with iCloud passwords.)
One thing that gives me a bit of hesitation is from a security standpoint - if we have access to each other's accounts and one of us falls victim to, for instance, a password-manager-level phishing scheme, the fallout from both of us having to recover from that at the same time is dramatically more of an inconvenience than if only one of us is affected.
Happy to hear from anyone else who's thought about this and any approaches they may have been taken - there doesn't seem to be much discussion about it online.
My break glass implementation is a printed sheet of all my financial orgs and account numbers (including bills I handle). All the beneficiary designations are done, so my wife would just need to give them the death certificate and she'd have control of the funds.
Some software should just be considered "done" and never changed again. 1Password is one of those things.
Personally, I noticed a slowdown in responsiveness immediately when switching from 7 to 8.
I miss 1Password Mini in particular still (and no, Quick Access is not a replacement).
After LastPass lost it I shopped around and avoided 1Password precisely because it looks and is marketed like typical feature-oriented apps powered by VC valuations and growth metrics. I do not like trigger happy product management near critical single-purpose software. It’s already quite challenging, because pw managers need (1) offline support (2) a sync protocol that’s virtually bug free and (3) state of the art crypto/security and (4) wide cross platform support.
I prefer such an app to sit basically dormant until there’s a new industry development (like passkeys) to keep up with the times. And even then, those features should only be added thoughtfully with a defensive mindset to ensure stability going forward.
So tldr, your stated benefits are in fact the very reason a lot of people don’t like it.
So if there's opportunity for a feature that adds real value for many people to an application without it affecting the core of the product, it shouldn't be added? I can add passwords and unlock websites just as quickly with 1Password as I could 8 years ago. Why does adding other useful, related features make a difference?
You say you can do things as fast as you could eight years ago -- but I can _not._
See my comment here: https://news.ycombinator.com/item?id=40644525
Of course, these things can happen to any product in theory, but with experience I’ve developed a bit of a radar for what kind of company is behind a product based on their design, website, marketing etc.
> Why does adding other useful, related features make a difference?
Like what? I’ve had the same experience with 2 pw managers for probably a decade, and the only noticeable change has been passkeys. Note that for me it’s personal use only though.
What is your experience exactly?
When my son was born I went to add his birth cert and SSN. I couldn’t. The “attach file” button is still there but it simply doesn’t work any more.
After hours of troubleshooting I finally found a discussion on their own support form where they acknowledged they explicitly disabled this feature. The solution is to switch to a paid subscription.
I’ll never buy software from them again. That’s just one example. They’ve removed similar functionality from cloud sync services to compel users to buy a subscription.
- They broke search in the past few months. I have multiple accounts with the same service (i.e. google, mercury) for personal and business. Now when searching it displays gibberish like 2FA backup codes from the notes instead of just having `${title} - ${username}` like it had for years
- They completely changed the left bar and moved around the entire UI multiple times. Credit cards used to be a simple click on the left side. Now I have to click "All Items" on the left side, then find the dropdown for "All Categories", click it, scroll down to Credit Cards and click on that.
It really comes down to the fact that it's a password manager. All it has to do is store passwords and fill them in when I need to sign in somewhere. Why has the UI fundamentally changed multiple times over the years throwing away all learned user behavior.
EDIT: There's also just the intangibles. I can't always remember specifics, but I "Feel" like 1password has been fighting me for years. I don't feel that way about many other pieces of software I use. 1Password just feels hostile in how they change/update things.
Cancelled my sub last night after many years.
I don't mind the price, or electron or anything, I just wanted it to fill the passwords in my browser reliably.
Some periods of time I simply went to copy from the app itself because the extension didn't work.
Been a paid customer for over a decade, and I originally bought it because the apps were so nice and they really did work 100%. The last couple of years have been painful at times though.
* Their syncing broke, and their support promised that buying a subscription would make it work. I did. It didn't. A year later I managed to get it fixed. I'm now on a permanent subscription for something I used to own -- that's not bad by itself, but the feeling I've been taken advantage of, and promised something that was false, leaves a bad taste.
* Syncing sometimes doesn't work anyway. I might add an account on my laptop and not be able to access it on my phone for a day or more.
* It's much buggier. Sometimes the Mac app just doesn't appear when you click the menu bar icon (this happened to me just a minute ago.) You have to right-click and select Open 1Password to get the full app, after which the menu bar app will now work. Sometimes. Right now, it's not no matter what I do. Why? No idea, it's random.
* Basic password features seem missing. There is _still_ no way to edit in a 'Remember me' checkbox on a login form. I would like 1P to set that checkbox.
* The UX design gets worse each release. In 1Password 8 they removed the useful menu in the Mac menu bar. I can't check what it is now because of the bug above, but it used to show a list of passwords. Now it has some kind of pseudo-intelligent other menu that has to be invoked via a shortcut and the Mac menu bar app actually does almost nothing useful.
* Not to mention their UX design which comes from the "hide buttons until you mouse over and click a button you didn't realise was there" school of intuitiveness.
* More UX: the iOS app now has a list of favorites, but it's almost impossible to get the info you want. Take a bank card: you can tap it in the list to show the name, card number, etc, but if you want the ATM pin -- which is the number I most forget, and the useful one because my card number is saved everywhere that uses it -- you have to dig into the item itself. How? Via a tiny, tiny untappable arrow.
Worst is that interactions with them show an attitude that they think they're building a better and better app each release. They're not. I cannot wait until I can move away to the new Passwords app.
Another data point: my 85 year old mother used to have issues with 7. She'd get confused about things. With 8, it's been clear sailing for her. That's pretty impressive to me.
On macOS 1pw 7 worked with no issues, 1pw 8 doesn't
However the big issue is that 1pw8 requires you to use their cloud - so if someone takes over the company and changes things or the company goes bust or even if the company's servers get hit by DDOS you lose all things. 1pw7 allowed you to keep the main db on anything and use multiple sync mechanism. For example you could keep the data all on machines you own, you could be a business and that would matter for security. Yes cloud etc is secure but there are cases where you don't want things to be anywhere not on your machines.
You can still use the standalone 1Password 6…
Plus a nice UI for handling OTP, notes, credit cards, IDs, bank accounts, etc, it's easily worth the annual price for me.
Love the service, the problem is they effectively charge a 1-5% commission to use it because you lose credit card loyalty/rewards programs benefits. Last year I got nearly 3% back, I think that's too high for the service. I don't think there's any way around it unfortunately, credit cards rewards are paid by the fees and interest of those who carry a balance.
On topic, as a primarily Linux user I'm not in the target market for this (or any other Apple products or services really) and that's fine.
So I put vaultwarden on the cluster at home, built a backup routine I was comfortable with and started using BitWarden to evaluate it before trying to help the whole family switch (we have 8 users, including a grandmother and grandfather from different sides of the family).
All this to say, I have to agree. I could not, and will not, switch my family to BitWarden (for the foreseeable future). Search is AWFUL, there’s no way to sort my passwords (recently added, recently updated, etc.) and the clients are way way way slower than 1P (sure, probably in part to server on an underpowered compute instance). However, even the “offline behaviour” (when BitWarden clients can’t contact the server) is slow, and sometimes syncing just doesn’t work.
I completely agree, the worst part is just how limited and clumsy the front-end is for secret storing. It’s limited, ugly, and often hard to parse visually. I can’t imagine trying to help my aging father use it on his desktop, much less his smartphone - where he’s had great success with 1P.
While I continue to have great disdain for AgileBits, 1P is still the most user friendly password manager for a group that includes definitely-not-technically-inclined people. I wish it wasn’t, I wish I could stop giving them money, but compared to the competition, there’s just nothing else that comes close.
Bitwarden still fails to correctly identify basic username/password fields, but 1Password gets it right every single time.
there is more, too lazy to write
https://en.wikipedia.org/wiki/LastPass#2022_customer_data_an...
The article text mentions 1Password as the first listed PWM product.
If I understand:
Attackers got access to LastPass's account data backups directly and in bulk. 2FA doesn't help here.
While LastPass since increased their password rounds for new accounts to 100k+, many users especially long-time users had them set well below and never updated. Reports of 5000 rounds, 500 rounds, ... even 1 round.
URLs were not encrypted. If you had sensitive URLs, I think you have to treat them as compromised. If you had crypto exchange logins or high-value URLs, I'd imagine you might attract extra attention.
[edit for typos].
2017: Design flaws in LastPass two factor authentication. http://www.martinvigo.com/design-flaws-lastpass-2fa-implemen...
2016: More LastPass security vulnerabilities. https://palant.de/2016/09/16/more-last-pass-security-vulnera...
2015: Even the LastPass will be stolen. http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...
If the Family Sharing aspects are well done I'd happily say goodbye to my 1Password subscription.
Regardless, I’ve been using it for years now. Works fine. Better UI will be nice assuming this doesn’t come with a bunch of updates that somehow manage to make it work less-well.
As mentioned in another news article on the topic:
> It also syncs with PCs via the iCloud for Windows app.
* https://www.theverge.com/2024/6/10/24175505/apple-password-a...
and in the keynote itself:
I guess Apple does not think that 2024 will be the Year of the Linux Desktop.
If password managers could interfere with password fields in Firefox without its help, malware could do that, too.
Or is there a generic password manager API on Windows that Apple doesn’t implement?
1: https://en.wikipedia.org/wiki/Usage_share_of_web_browsers
I mean, why else would Apple invest in something like this. They became the richest company in the world by increasing lock-in in every step.
The new SSH key manager feature is an example of something Apple's unlikely to address for years, if ever. https://developer.1password.com/docs/ssh/manage-keys/
I switched to iCloud Passwords a few months ago and I'm very happy with the product. Looks like this Passwords app is a nice new GUI over the top of that same database.
1P has some wonderful work-oriented features we use constantly. I don't like the direction it's going for personal stuff.
1Password saves the key itself in the encrypted vault and implements an SSH agent that can then interact with OpenSSH etc. and provide key operations, like how a physical dongle would function.
It's almost double the price per user so my company switched to Bitwarden.
We're a Mac shop and if Apple can make it even more affordable then we would definitely consider switching again.